Authentication

Sat, 04 Apr 2026 12:26:57 +0000

Google authentication

Requests from a Grafana plugin to Google are made on behalf of an IAM role or an IAM user. The IAM user or IAM role must have the associated policies to perform certain API actions. Since these policies are specific to each data source, refer to the data source documentation for details. All requests to Google APIs are performed on the server-side by the Grafana backend.

You can authenticate a Grafana plugin to Google by uploading a Google JWT file or by automatically retrieving credentials from the Google metadata server. The latter option is only available when running Grafana on GCE virtual machine.

Using Google Service Account Key File

To authenticate the Grafana plugin with the Google API, create a Google Cloud Platform (GCP) Service Account for the Project you want to show data. A Grafana data source integrates with one GCP Project. If you want to visualize data from multiple GCP Projects, then create one data source per GCP Project.

Create a GCP Service Account for a Project

Navigate to the APIs and Services Credentials page.
Click on the Create credentials dropdown and select the Service account option.
In Service account name, enter a name for the account.
From the Role dropdown, choose the roles required by the specific plugin.
Click Done.
Use the newly created account to create a service account key. A JSON key file is created and downloaded to your computer.
Store this file in a secure place as it allows access to your Google data.
Upload the key to Grafana via the data source configuration page. The file contents is encrypted and saved in the Grafana database. Don’t forget to save the file after uploading!

Using GCE Default Service Account

When Grafana is running on a Google Compute Engine (GCE) virtual machine, Grafana can automatically retrieve default credentials from the metadata server. As a result, there is no need to generate a private key file for the service account. You also do not need to upload the file to Grafana. The following preconditions must be met before Grafana can retrieve default credentials.

You must create a Service Account for use by the GCE virtual machine. For more information, refer to Create new service account.
Verify that the GCE virtual machine instance is running as the service account that you created. For more information, refer to setting up an instance to run as a service account.
Allow access to the specified API scope.

For more information about creating and enabling service accounts for GCE instances, refer to enabling service accounts for instances in Google documentation.

Preconfigured dashboards

Sat, 04 Apr 2026 12:26:57 +0000

Preconfigured Cloud Monitoring dashboards

Google Cloud Monitoring data source ships with pre-configured dashboards for some of the most popular GCP services. These curated dashboards are based on similar dashboards in the GCP dashboard samples repository. See also, Using Google Cloud Monitoring in Grafana for detailed instructions on how to add and configure the Google Cloud Monitoring data source.

Curated dashboards

To import the curated dashboards:

On the configuration page of your Cloud Monitoring data source, click the Dashboards tab.
Click Import for the dashboard you would like to use.

The data source of the newly created dashboard panels will be the one selected above. The dashboards have a template variable that is populated with the projects accessible by the configured service account every time the dashboard is loaded. After the dashboard is loaded, you can select the project you prefer from the drop-down list.

In case you want to customize a dashboard, we recommend that you save it under a different name. Otherwise the dashboard will be overwritten when a new version of the dashboard is released.

Google Cloud Monitoring on Grafana Labs